Support policy.yaml file [part 2]

- Keystone
- Glance
- Nova
- Cinder

This will copy only yaml or json policy file if they exist.

Change-Id: I4a9415d82322aed68c9b7650bdf346f58fa49e2a
Implements: blueprint support-custom-policy-yaml
Co-authored-By: Duong Ha-Quang <duonghq@vn.fujitsu.com>

ansible/roles/cinder/handlers/main.yml

@@ -5,7 +5,7 @@
     service: "{{ cinder_services[service_name] }}"
     config_json: "{{ cinder_config_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
     cinder_conf: "{{ cinder_confs.results|selectattr('item.key', 'equalto', service_name)|first }}"
-    policy_json: "{{ cinder_policy_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
+    policy_overwriting: "{{ cinder_policy_overwriting.results|selectattr('item.key', 'equalto', service_name)|first }}"
     cinder_api_container: "{{ check_cinder_containers.results|selectattr('item.key', 'equalto', service_name)|first }}"
   kolla_docker:
     action: "recreate_or_restart_container"
@@ -20,7 +20,7 @@
     - config_json.changed | bool
       or cinder_conf.changed | bool
       or wsgi_cinder_api.changed | bool
-      or policy_json.changed | bool
+      or policy_overwriting.changed | bool
       or cinder_api_container.changed | bool
 
 - name: Restart cinder-scheduler container
@@ -29,7 +29,7 @@
     service: "{{ cinder_services[service_name] }}"
     config_json: "{{ cinder_config_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
     cinder_conf: "{{ cinder_confs.results|selectattr('item.key', 'equalto', service_name)|first }}"
-    policy_json: "{{ cinder_policy_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
+    policy_overwriting: "{{ cinder_policy_overwriting.results|selectattr('item.key', 'equalto', service_name)|first }}"
     cinder_scheduler_container: "{{ check_cinder_containers.results|selectattr('item.key', 'equalto', service_name)|first }}"
   kolla_docker:
     action: "recreate_or_restart_container"
@@ -43,7 +43,7 @@
     - service.enabled | bool
     - config_json.changed | bool
       or cinder_conf.changed | bool
-      or policy_json.changed | bool
+      or policy_overwriting.changed | bool
       or cinder_scheduler_container.changed | bool
 
 - name: Restart cinder-volume container
@@ -52,7 +52,7 @@
     service: "{{ cinder_services[service_name] }}"
     config_json: "{{ cinder_config_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
     cinder_conf: "{{ cinder_confs.results|selectattr('item.key', 'equalto', service_name)|first }}"
-    policy_json: "{{ cinder_policy_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
+    policy_overwriting: "{{ cinder_policy_overwriting.results|selectattr('item.key', 'equalto', service_name)|first }}"
     cinder_volume_container: "{{ check_cinder_containers.results|selectattr('item.key', 'equalto', service_name)|first }}"
   kolla_docker:
     action: "recreate_or_restart_container"
@@ -68,7 +68,7 @@
     - service.enabled | bool
     - config_json.changed | bool
       or cinder_conf.changed | bool
-      or policy_json.changed | bool
+      or policy_overwriting.changed | bool
       or cinder_volume_container.changed | bool
 
 - name: Restart cinder-backup container
@@ -77,7 +77,7 @@
     service: "{{ cinder_services[service_name] }}"
     config_json: "{{ cinder_config_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
     cinder_conf: "{{ cinder_confs.results|selectattr('item.key', 'equalto', service_name)|first }}"
-    policy_json: "{{ cinder_policy_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
+    policy_overwriting: "{{ cinder_policy_overwriting.results|selectattr('item.key', 'equalto', service_name)|first }}"
     cinder_backup_container: "{{ check_cinder_containers.results|selectattr('item.key', 'equalto', service_name)|first }}"
   kolla_docker:
     action: "recreate_or_restart_container"
@@ -92,5 +92,5 @@
     - service.enabled | bool
     - config_json.changed | bool
       or cinder_conf.changed | bool
-      or policy_json.changed | bool
+      or policy_overwriting.changed | bool
       or cinder_backup_container.changed | bool

ansible/roles/cinder/tasks/config.yml

@@ -9,6 +9,23 @@
     - item.value.enabled | bool
   with_dict: "{{ cinder_services }}"
 
+- name: Check if policies shall be overwritten
+  local_action: stat path="{{ item }}"
+  run_once: True
+  register: cinder_policy
+  with_first_found:
+    - files: "{{ supported_policy_format_list }}"
+      paths:
+        - "{{ node_custom_config }}/cinder/"
+      skip: true
+
+- name: Set cinder policy file
+  set_fact:
+    cinder_policy_file: "{{ cinder_policy.results.0.stat.path | basename }}"
+    cinder_policy_file_path: "{{ cinder_policy.results.0.stat.path }}"
+  when:
+    - cinder_policy.results
+
 - name: Copying over config.json files for services
   template:
     src: "{{ item.key }}.json.j2"
@@ -63,18 +80,13 @@
     - Restart cinder-volume container
     - Restart cinder-backup container
 
-- name: Check if policies shall be overwritten
+- name: Copying over existing policy file
-  local_action: stat path="{{ node_custom_config }}/cinder/policy.json"
-  run_once: True
-  register: cinder_policy
-
-- name: Copying over existing policy.json
   template:
-    src: "{{ node_custom_config }}/cinder/policy.json"
+    src: "{{ cinder_policy_file_path }}"
-    dest: "{{ node_config_directory }}/{{ item.key }}/policy.json"
+    dest: "{{ node_config_directory }}/{{ item.key }}/{{ cinder_policy_file }}"
-  register: cinder_policy_jsons
+  register: cinder_policy_overwriting
   when:
-    - cinder_policy.stat.exists
+    - cinder_policy_file is defined
     - inventory_hostname in groups[item.value.group]
   with_dict: "{{ cinder_services }}"
   notify:

ansible/roles/cinder/templates/cinder-api.json.j2

@@ -14,14 +14,13 @@
             "dest": "/etc/{{ cinder_dir }}/cinder-wsgi.conf",
             "owner": "cinder",
             "perm": "0600"
-        },
+        }{% if cinder_policy_file is defined %},
         {
-            "source": "{{ container_config_directory }}/policy.json",
+            "source": "{{ container_config_directory }}/{{ cinder_policy_file }}",
-            "dest": "/etc/cinder/policy.json",
+            "dest": "/etc/cinder/{{ cinder_policy_file }}",
             "owner": "cinder",
-            "perm": "0600",
+            "perm": "0600"
-            "optional": true
+        }{% endif %}
-        }
     ],
     "permissions": [
         {

ansible/roles/cinder/templates/cinder-backup.json.j2

@@ -6,14 +6,13 @@
             "dest": "/etc/cinder/cinder.conf",
             "owner": "cinder",
             "perm": "0600"
-        },
+        }{% if cinder_policy_file is defined %},
         {
-            "source": "{{ container_config_directory }}/policy.json",
+            "source": "{{ container_config_directory }}/{{ cinder_policy_file }}",
-            "dest": "/etc/cinder/policy.json",
+            "dest": "/etc/cinder/{{ cinder_policy_file }}",
             "owner": "cinder",
-            "perm": "0600",
+            "perm": "0600"
-            "optional": true
+        }{% endif %}{% if cinder_backend_ceph | bool %},
-        }{% if cinder_backend_ceph | bool %},
         {
             "source": "{{ container_config_directory }}/ceph.*",
             "dest": "/etc/ceph/",

ansible/roles/cinder/templates/cinder-scheduler.json.j2

@@ -6,14 +6,13 @@
             "dest": "/etc/cinder/cinder.conf",
             "owner": "cinder",
             "perm": "0600"
-        },
+        }{% if cinder_policy_file is defined %},
         {
-            "source": "{{ container_config_directory }}/policy.json",
+            "source": "{{ container_config_directory }}/{{ cinder_policy_file }}",
-            "dest": "/etc/cinder/policy.json",
+            "dest": "/etc/cinder/{{ cinder_policy_file }}",
             "owner": "cinder",
-            "perm": "0600",
+            "perm": "0600"
-            "optional": true
+        }{% endif %}
-        }
     ],
     "permissions": [
         {

ansible/roles/cinder/templates/cinder-volume.json.j2

@@ -27,14 +27,13 @@
             "owner": "cinder",
             "perm": "0600",
             "optional": {{ (not enable_cinder_backend_nfs | bool) | string | lower }}
-        },
+        }{% if cinder_policy_file is defined %},
         {
-            "source": "{{ container_config_directory }}/policy.json",
+            "source": "{{ container_config_directory }}/{{ cinder_policy_file }}",
-            "dest": "/etc/cinder/policy.json",
+            "dest": "/etc/cinder/{{ cinder_policy_file }}",
             "owner": "cinder",
-            "perm": "0600",
+            "perm": "0600"
-            "optional": true
+        }{% endif %}
-        }
     ],
     "permissions": [
         {

ansible/roles/cinder/templates/cinder.conf.j2

@@ -68,6 +68,11 @@ topics = notifications
 driver = noop
 {% endif %}
 
+{% if cinder_policy_file is defined %}
+[oslo_policy]
+policy_file = {{ cinder_policy_file }}
+{% endif %}
+
 [nova]
 region_name = {{ openstack_region_name }}
 interface = internal

ansible/roles/glance/handlers/main.yml

@@ -5,7 +5,7 @@
     service: "{{ glance_services[service_name] }}"
     config_json: "{{ glance_config_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
     glance_conf: "{{ glance_confs.results|selectattr('item.key', 'equalto', service_name)|first }}"
-    policy_json: "{{ glance_policy_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
+    policy_overwriting: "{{ glance_policy_overwriting.results|selectattr('item.key', 'equalto', service_name)|first }}"
     glance_api_container: "{{ check_glance_containers.results|selectattr('item.key', 'equalto', service_name)|first }}"
   kolla_docker:
     action: "recreate_or_restart_container"
@@ -20,7 +20,7 @@
     - config_json.changed | bool
       or glance_conf.changed | bool
       or glance_swift_conf.changed | bool
-      or policy_json.changed | bool
+      or policy_overwriting.changed | bool
       or glance_api_container.changed | bool
 
 - name: Restart glance-registry container
@@ -29,7 +29,7 @@
     service: "{{ glance_services[service_name] }}"
     config_json: "{{ glance_config_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
     glance_conf: "{{ glance_confs.results|selectattr('item.key', 'equalto', service_name)|first }}"
-    policy_json: "{{ glance_policy_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
+    policy_overwriting: "{{ glance_policy_overwriting.results|selectattr('item.key', 'equalto', service_name)|first }}"
     glance_registry_container: "{{ check_glance_containers.results|selectattr('item.key', 'equalto', service_name)|first }}"
   kolla_docker:
     action: "recreate_or_restart_container"
@@ -43,6 +43,6 @@
     - service.enabled | bool
     - config_json.changed | bool
       or glance_conf.changed | bool
-      or policy_json.changed | bool
+      or policy_overwriting.changed | bool
       or glance_registry_container.changed | bool
 

ansible/roles/glance/tasks/config.yml

@@ -22,6 +22,23 @@
     - item.value.enabled | bool
   with_dict: "{{ glance_services }}"
 
+- name: Check if policies shall be overwritten
+  local_action: stat path="{{ item }}"
+  run_once: True
+  register: glance_policy
+  with_first_found:
+    - files: "{{ supported_policy_format_list }}"
+      paths:
+        - "{{ node_custom_config }}/glance/"
+      skip: true
+
+- name: Set glance policy file
+  set_fact:
+    glance_policy_file: "{{ glance_policy.results.0.stat.path | basename }}"
+    glance_policy_file_path: "{{ glance_policy.results.0.stat.path }}"
+  when:
+    - glance_policy.results
+
 - name: Copying over config.json files for services
   template:
     src: "{{ item.key }}.json.j2"
@@ -59,11 +76,6 @@
     - Restart glance-api container
     - Restart glance-registry container
 
-- name: Check if policies shall be overwritten
-  local_action: stat path="{{ node_custom_config }}/glance/policy.json"
-  run_once: True
-  register: glance_policy
-
 - name: Copying over glance-swift.conf for glance_api
   vars:
     glance_api: "{{ glance_services['glance-api'] }}"
@@ -82,15 +94,15 @@
   notify:
     - Restart glance-api container
 
-- name: Copying over existing policy.json
+- name: Copying over existing policy file
   template:
-    src: "{{ node_custom_config }}/glance/policy.json"
+    src: "{{ glance_policy_file_path }}"
-    dest: "{{ node_config_directory }}/{{ item.key }}/policy.json"
+    dest: "{{ node_config_directory }}/{{ item.key }}/{{ glance_policy_file_path }}"
     mode: "0660"
   become: true
-  register: glance_policy_jsons
+  register: glance_policy_overwriting
   when:
-    - glance_policy.stat.exists
+    - glance_policy_file is defined
     - inventory_hostname in groups[item.value.group]
   with_dict: "{{ glance_services }}"
   notify:

ansible/roles/glance/templates/glance-api.conf.j2

@@ -89,6 +89,11 @@ driver = messagingv2
 driver = noop
 {% endif %}
 
+{% if glance_policy_file is defined %}
+[oslo_policy]
+policy_file = {{ glance_policy_file }}
+{% endif %}
+
 {% if enable_osprofiler | bool %}
 [profiler]
 enabled = true

ansible/roles/glance/templates/glance-api.json.j2

@@ -6,14 +6,13 @@
             "dest": "/etc/glance/glance-api.conf",
             "owner": "glance",
             "perm": "0600"
-        },
+        }{% if glance_policy_file is defined %},
         {
-            "source": "{{ container_config_directory }}/policy.json",
+            "source": "{{ container_config_directory }}/{{ glance_policy_file }}",
-            "dest": "/etc/glance/policy.json",
+            "dest": "/etc/glance/{{ glance_policy_file }}",
             "owner": "glance",
-            "perm": "0600",
+            "perm": "0600"
-            "optional": true
+        }{% endif %}{% if glance_backend_ceph | bool %},
-        }{% if glance_backend_ceph | bool %},
         {
             "source": "{{ container_config_directory }}/ceph.*",
             "dest": "/etc/ceph/",

ansible/roles/glance/templates/glance-registry.conf.j2

@@ -39,6 +39,11 @@ driver = messagingv2
 driver = noop
 {% endif %}
 
+{% if glance_policy_file is defined %}
+[oslo_policy]
+policy_file = {{ glance_policy_file }}
+{% endif %}
+
 {% if enable_osprofiler | bool %}
 [profiler]
 enabled = true

ansible/roles/glance/templates/glance-registry.json.j2

@@ -6,14 +6,13 @@
             "dest": "/etc/glance/glance-registry.conf",
             "owner": "glance",
             "perm": "0600"
-        },
+        }{% if glance_policy_file is defined %},
         {
-            "source": "{{ container_config_directory }}/policy.json",
+            "source": "{{ container_config_directory }}/{{ glance_policy_file }}",
-            "dest": "/etc/glance/policy.json",
+            "dest": "/etc/glance/{{ glance_policy_file }}",
             "owner": "glance",
-            "perm": "0600",
+            "perm": "0600"
-            "optional": true
+        }{% endif %}
-        }
     ],
     "permissions": [
         {

ansible/roles/keystone/handlers/main.yml

@@ -31,7 +31,7 @@
     service: "{{ keystone_services[service_name] }}"
     config_json: "{{ keystone_config_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
     keystone_conf: "{{ keystone_confs.results|selectattr('item.key', 'equalto', service_name)|first  }}"
-    policy_json: "{{ keystone_policy_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
+    policy_overwriting: "{{ keystone_policy_overwriting.results|selectattr('item.key', 'equalto', service_name)|first }}"
     keystone_container: "{{ check_keystone_containers.results|selectattr('item.key', 'equalto', service_name)|first }}"
   kolla_docker:
     action: "recreate_or_restart_container"
@@ -46,7 +46,7 @@
     - config_json.changed | bool
       or keystone_conf.changed | bool
       or keystone_domains.changed | bool
-      or policy_json.changed | bool
+      or policy_overwriting.changed | bool
       or keystone_wsgi.changed | bool
       or keystone_paste_ini.changed | bool
       or keystone_container.changed | bool
@@ -57,7 +57,7 @@
     service: "{{ keystone_services[service_name] }}"
     config_json: "{{ keystone_config_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
     keystone_conf: "{{ keystone_confs.results|selectattr('item.key', 'equalto', service_name)|first  }}"
-    policy_json: "{{ keystone_policy_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
+    policy_overwriting: "{{ keystone_policy_overwriting.results|selectattr('item.key', 'equalto', service_name)|first }}"
     keystone_fernet_container: "{{ check_keystone_containers.results|selectattr('item.key', 'equalto', service_name)|first }}"
   kolla_docker:
     action: "recreate_or_restart_container"
@@ -71,7 +71,7 @@
     - service.enabled | bool
     - config_json.changed | bool
       or keystone_conf.changed | bool
-      or policy_json.changed | bool
+      or policy_overwriting.changed | bool
       or keystone_fernet_confs.changed | bool
       or keystone_fernet_container.changed | bool
 

ansible/roles/keystone/tasks/config.yml

@@ -1,8 +1,20 @@
 ---
 - name: Check if policies shall be overwritten
-  local_action: stat path="{{ node_custom_config }}/keystone/policy.json"
+  local_action: stat path="{{ item }}"
   run_once: True
   register: keystone_policy
+  with_first_found:
+    - files: "{{ supported_policy_format_list }}"
+      paths:
+        - "{{ node_custom_config }}/keystone/"
+      skip: true
+
+- name: Set keystone policy file
+  set_fact:
+    keystone_policy_file: "{{ keystone_policy.results.0.stat.path | basename }}"
+    keystone_policy_file_path: "{{ keystone_policy.results.0.stat.path }}"
+  when:
+    - keystone_policy.results
 
 - name: Check if Keystone Domain specific settings enabled
   local_action: stat path="{{ node_custom_config }}/keystone/domains"
@@ -107,18 +119,18 @@
   notify:
     - Restart keystone container
 
-- name: Copying over existing policy.json
+- name: Copying over existing policy file
   template:
-    src: "{{ node_custom_config }}/keystone/policy.json"
+    src: "{{ keystone_policy_file_path }}"
-    dest: "{{ node_config_directory }}/{{ item.key }}/policy.json"
+    dest: "{{ node_config_directory }}/{{ item.key }}/{{ keystone_policy_file }}"
     mode: "0660"
   become: true
-  register: keystone_policy_jsons
+  register: keystone_policy_overwriting
   when:
     - inventory_hostname in groups[item.value.group]
     - item.key in [ "keystone", "keystone-fernet" ]
     - item.value.enabled | bool
-    - keystone_policy.stat.exists
+    - keystone_policy_file is defined
   with_dict: "{{ keystone_services }}"
   notify:
     - Restart keystone container

ansible/roles/keystone/templates/keystone-fernet.json.j2

@@ -36,13 +36,12 @@
             "dest": "/var/lib/keystone/.ssh/id_rsa",
             "owner": "keystone",
             "perm": "0600"
-        },
+        }{% if keystone_policy_file is defined %},
         {
-            "source": "{{ container_config_directory }}/policy.json",
+            "source": "{{ container_config_directory }}/{{ keystone_policy_file }}",
-            "dest": "/etc/keystone/policy.json",
+            "dest": "/etc/keystone/{{ keystone_policy_file }}",
             "owner": "keystone",
-            "perm": "0600",
+            "perm": "0600"
-            "optional": true
+        }{% endif %}
-        }
     ]
 }

ansible/roles/keystone/templates/keystone.conf.j2

@@ -13,6 +13,11 @@ use_stderr = True
 [oslo_middleware]
 enable_proxy_headers_parsing = True
 
+{% if keystone_policy_file is defined %}
+[oslo_policy]
+policy_file = {{ keystone_policy_file }}
+{% endif %}
+
 [database]
 connection = mysql+pymysql://{{ keystone_database_user }}:{{ keystone_database_password }}@{{ keystone_database_address }}/{{ keystone_database_name }}
 max_retries = -1

ansible/roles/keystone/templates/keystone.json.j2

@@ -22,14 +22,13 @@
             "owner": "keystone",
             "perm": "0700",
             "optional": true
-        },
+        }{% if keystone_policy_file is defined %},
         {
-            "source": "{{ container_config_directory }}/policy.json",
+            "source": "{{ container_config_directory }}/{{ keystone_policy_file }}",
-            "dest": "/etc/keystone/policy.json",
+            "dest": "/etc/keystone/{{ keystone_policy_file }}",
             "owner": "keystone",
-            "perm": "0600",
+            "perm": "0600"
-            "optional": true
+        }{% endif %},
-        },
         {
             "source": "{{ container_config_directory }}/wsgi-keystone.conf",
             "dest": "/etc/{{ keystone_dir }}/wsgi-keystone.conf",

ansible/roles/nova/handlers/main.yml

@@ -54,7 +54,7 @@
     service: "{{ nova_services[service_name] }}"
     config_json: "{{ config_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
     nova_conf: "{{ nova_confs.results|selectattr('item.key', 'equalto', service_name)|first }}"
-    policy_json: "{{ policy_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
+    policy_overwriting: "{{ nova_policy_overwriting.results|selectattr('item.key', 'equalto', service_name)|first }}"
     placement_api_container: "{{ check_nova_containers.results|selectattr('item.key', 'equalto', service_name)|first }}"
   kolla_docker:
     action: "recreate_or_restart_container"
@@ -68,7 +68,7 @@
     - service.enabled | bool
     - config_json.changed | bool
       or nova_conf.changed | bool
-      or policy_json.changed | bool
+      or policy_overwriting.changed | bool
       or placement_api_wsgi_conf | changed
       or placement_api_container.changed | bool
 
@@ -78,7 +78,7 @@
     service: "{{ nova_services[service_name] }}"
     config_json: "{{ config_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
     nova_conf: "{{ nova_confs.results|selectattr('item.key', 'equalto', service_name)|first }}"
-    policy_json: "{{ policy_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
+    policy_overwriting: "{{ nova_policy_overwriting.results|selectattr('item.key', 'equalto', service_name)|first }}"
     nova_api_container: "{{ check_nova_containers.results|selectattr('item.key', 'equalto', service_name)|first }}"
   kolla_docker:
     action: "recreate_or_restart_container"
@@ -93,7 +93,7 @@
     - service.enabled | bool
     - config_json.changed | bool
       or nova_conf.changed | bool
-      or policy_json.changed | bool
+      or policy_overwriting.changed | bool
       or nova_api_container.changed | bool
 
 - name: Restart nova-scheduler container
@@ -102,7 +102,7 @@
     service: "{{ nova_services[service_name] }}"
     config_json: "{{ config_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
     nova_conf: "{{ nova_confs.results|selectattr('item.key', 'equalto', service_name)|first }}"
-    policy_json: "{{ policy_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
+    policy_overwriting: "{{ nova_policy_overwriting.results|selectattr('item.key', 'equalto', service_name)|first }}"
     nova_scheduler_container: "{{ check_nova_containers.results|selectattr('item.key', 'equalto', service_name)|first }}"
   kolla_docker:
     action: "recreate_or_restart_container"
@@ -117,7 +117,7 @@
     - service.enabled | bool
     - config_json.changed | bool
       or nova_conf.changed | bool
-      or policy_json.changed | bool
+      or policy_overwriting.changed | bool
       or nova_scheduler_container.changed | bool
 
 - name: Restart nova-conductor container
@@ -126,7 +126,7 @@
     service: "{{ nova_services[service_name] }}"
     config_json: "{{ config_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
     nova_conf: "{{ nova_confs.results|selectattr('item.key', 'equalto', service_name)|first }}"
-    policy_json: "{{ policy_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
+    policy_overwriting: "{{ nova_policy_overwriting.results|selectattr('item.key', 'equalto', service_name)|first }}"
     nova_conductor_container: "{{ check_nova_containers.results|selectattr('item.key', 'equalto', service_name)|first }}"
   kolla_docker:
     action: "recreate_or_restart_container"
@@ -141,7 +141,7 @@
     - service.enabled | bool
     - config_json.changed | bool
       or nova_conf.changed | bool
-      or policy_json.changed | bool
+      or policy_overwriting.changed | bool
       or nova_conductor_container.changed | bool
 
 
@@ -151,7 +151,7 @@
     service: "{{ nova_services[service_name] }}"
     config_json: "{{ config_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
     nova_conf: "{{ nova_confs.results|selectattr('item.key', 'equalto', service_name)|first }}"
-    policy_json: "{{ policy_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
+    policy_overwriting: "{{ nova_policy_overwriting.results|selectattr('item.key', 'equalto', service_name)|first }}"
     nova_consoleauth_container: "{{ check_nova_containers.results|selectattr('item.key', 'equalto', service_name)|first }}"
   kolla_docker:
     action: "recreate_or_restart_container"
@@ -166,7 +166,7 @@
     - service.enabled | bool
     - config_json.changed | bool
       or nova_conf.changed | bool
-      or policy_json.changed | bool
+      or policy_overwriting.changed | bool
       or nova_consoleauth_container.changed | bool
 
 - name: Restart nova-novncproxy container
@@ -175,7 +175,7 @@
     service: "{{ nova_services[service_name] }}"
     config_json: "{{ config_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
     nova_conf: "{{ nova_confs.results|selectattr('item.key', 'equalto', service_name)|first }}"
-    policy_json: "{{ policy_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
+    policy_overwriting: "{{ nova_policy_overwriting.results|selectattr('item.key', 'equalto', service_name)|first }}"
     nova_novncproxy_container: "{{ check_nova_containers.results|selectattr('item.key', 'equalto', service_name)|first }}"
   kolla_docker:
     action: "recreate_or_restart_container"
@@ -190,7 +190,7 @@
     - service.enabled | bool
     - config_json.changed | bool
       or nova_conf.changed | bool
-      or policy_json.changed | bool
+      or policy_overwriting.changed | bool
       or nova_novncproxy_container.changed | bool
 
 - name: Restart nova-spicehtml5proxy container
@@ -199,7 +199,7 @@
     service: "{{ nova_services[service_name] }}"
     config_json: "{{ config_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
     nova_conf: "{{ nova_confs.results|selectattr('item.key', 'equalto', service_name)|first }}"
-    policy_json: "{{ policy_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
+    policy_overwriting: "{{ nova_policy_overwriting.results|selectattr('item.key', 'equalto', service_name)|first }}"
     nova_spicehtml5proxy_container: "{{ check_nova_containers.results|selectattr('item.key', 'equalto', service_name)|first }}"
   kolla_docker:
     action: "recreate_or_restart_container"
@@ -214,7 +214,7 @@
     - service.enabled | bool
     - config_json.changed | bool
       or nova_conf.changed | bool
-      or policy_json.changed | bool
+      or policy_overwriting.changed | bool
       or nova_spicehtml5proxy_container.changed | bool
 
 - name: Restart nova-serialproxy container
@@ -223,7 +223,7 @@
     service: "{{ nova_services[service_name] }}"
     config_json: "{{ config_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
     nova_conf: "{{ nova_confs.results|selectattr('item.key', 'equalto', service_name)|first }}"
-    policy_json: "{{ policy_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
+    policy_overwriting: "{{ nova_policy_overwriting.results|selectattr('item.key', 'equalto', service_name)|first }}"
     nova_serialproxy_container: "{{ check_nova_containers.results|selectattr('item.key', 'equalto', service_name)|first }}"
   kolla_docker:
     action: "recreate_or_restart_container"
@@ -238,7 +238,7 @@
     - service.enabled | bool
     - config_json.changed | bool
       or nova_conf.changed | bool
-      or policy_json.changed | bool
+      or policy_overwriting.changed | bool
       or nova_serialproxy_container.changed | bool
 
 - name: Restart nova-compute container
@@ -247,7 +247,7 @@
     service: "{{ nova_services[service_name] }}"
     config_json: "{{ config_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
     nova_conf: "{{ nova_confs.results|selectattr('item.key', 'equalto', service_name)|first }}"
-    policy_json: "{{ policy_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
+    policy_overwriting: "{{ nova_policy_overwriting.results|selectattr('item.key', 'equalto', service_name)|first }}"
     nova_compute_container: "{{ check_nova_containers.results|selectattr('item.key', 'equalto', service_name)|first }}"
   kolla_docker:
     action: "recreate_or_restart_container"
@@ -263,7 +263,7 @@
     - service.enabled | bool
     - config_json.changed | bool
       or nova_conf.changed | bool
-      or policy_json.changed | bool
+      or policy_overwriting.changed | bool
       or vcenter_ca_file | bool
       or nova_compute_container.changed | bool
 
@@ -273,7 +273,7 @@
     service: "{{ nova_services[service_name] }}"
     config_json: "{{ config_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
     nova_conf: "{{ nova_confs.results|selectattr('item.key', 'equalto', service_name)|first }}"
-    policy_json: "{{ policy_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
+    policy_overwriting: "{{ nova_policy_overwriting.results|selectattr('item.key', 'equalto', service_name)|first }}"
     nova_compute_ironic_container: "{{ check_nova_containers.results|selectattr('item.key', 'equalto', service_name)|first }}"
   kolla_docker:
     action: "recreate_or_restart_container"
@@ -288,7 +288,7 @@
     - service.enabled | bool
     - config_json.changed | bool
       or nova_conf.changed | bool
-      or policy_json.changed | bool
+      or policy_overwriting.changed | bool
       or nova_compute_ironic_container.changed | bool
 
 # nova-compute-fake is special. It will start multi numbers of container

ansible/roles/nova/tasks/config.yml

@@ -24,6 +24,23 @@
     - item.value.enabled | bool
   with_dict: "{{ nova_services }}"
 
+- name: Check if policies shall be overwritten
+  local_action: stat path="{{ item }}"
+  run_once: True
+  register: nova_policy
+  with_first_found:
+    - files: "{{ supported_policy_format_list }}"
+      paths:
+        - "{{ node_custom_config }}/nova/"
+      skip: true
+
+- name: Set nova policy file
+  set_fact:
+    nova_policy_file: "{{ nova_policy.results.0.stat.path | basename }}"
+    nova_policy_file_path: "{{ nova_policy.results.0.stat.path }}"
+  when:
+    - nova_policy.results
+
 - name: Copying over config.json files for services
   become: true
   template:
@@ -138,12 +155,7 @@
   notify:
     - Restart nova-compute container
 
-- name: Check if policies shall be overwritten
+- name: Copying over existing policy file
-  local_action: stat path="{{ node_custom_config }}/nova/policy.json"
-  run_once: True
-  register: nova_policy
-
-- name: Copying over existing policy.json
   become: true
   vars:
     services_require_policy_json:
@@ -158,13 +170,13 @@
       - nova-scheduler
       - nova-spicehtml5proxy
   template:
-    src: "{{ node_custom_config }}/nova/policy.json"
+    src: "{{ nova_policy_file_path }}"
-    dest: "{{ node_config_directory }}/{{ item.key }}/policy.json"
+    dest: "{{ node_config_directory }}/{{ item.key }}/{{ nova_policy_file }}"
-  register: policy_jsons
+  register: nova_policy_overwriting
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
-    - nova_policy.stat.exists
+    - nova_policy_file is defined
     - item.key in services_require_policy_json
   with_dict: "{{ nova_services }}"
   notify:

ansible/roles/nova/templates/nova-api.json.j2

@@ -6,14 +6,13 @@
             "dest": "/etc/nova/nova.conf",
             "owner": "nova",
             "perm": "0600"
-        },
+        }{% if nova_policy_file is defined %},
         {
-            "source": "{{ container_config_directory }}/policy.json",
+            "source": "{{ container_config_directory }}/{{ nova_policy_file }}",
-            "dest": "/etc/nova/policy.json",
+            "dest": "/etc/nova/{{ nova_policy_file }}",
             "owner": "nova",
-            "perm": "0600",
+            "perm": "0600"
-            "optional": true
+        }{% endif %}
-        }
     ],
     "permissions": [
         {

ansible/roles/nova/templates/nova-compute-ironic.json.j2

@@ -6,14 +6,13 @@
             "dest": "/etc/nova/nova.conf",
             "owner": "nova",
             "perm": "0600"
-        },
+        }{% if nova_policy_file is defined %},
         {
-            "source": "{{ container_config_directory }}/policy.json",
+            "source": "{{ container_config_directory }}/{{ nova_policy_file }}",
-            "dest": "/etc/nova/policy.json",
+            "dest": "/etc/nova/{{ nova_policy_file }}",
             "owner": "nova",
-            "perm": "0600",
+            "perm": "0600"
-            "optional": true
+        }{% endif %}
-        }
     ],
     "permissions": [
         {

ansible/roles/nova/templates/nova-compute.json.j2

@@ -6,14 +6,13 @@
             "dest": "/etc/nova/nova.conf",
             "owner": "nova",
             "perm": "0600"
-        },
+        }{% if nova_policy_file is defined %},
         {
-            "source": "{{ container_config_directory }}/policy.json",
+            "source": "{{ container_config_directory }}/{{ nova_policy_file }}",
-            "dest": "/etc/nova/policy.json",
+            "dest": "/etc/nova/{{ nova_policy_file }}",
             "owner": "nova",
-            "perm": "0600",
+            "perm": "0600"
-            "optional": true
+        }{% endif %}{% if nova_backend == "rbd" %},
-        }{% if nova_backend == "rbd" %},
         {
             "source": "{{ container_config_directory }}/ceph.*",
             "dest": "/etc/ceph/",

ansible/roles/nova/templates/nova-conductor.json.j2

@@ -6,14 +6,13 @@
             "dest": "/etc/nova/nova.conf",
             "owner": "nova",
             "perm": "0600"
-        },
+        }{% if nova_policy_file is defined %},
         {
-            "source": "{{ container_config_directory }}/policy.json",
+            "source": "{{ container_config_directory }}/{{ nova_policy_file }}",
-            "dest": "/etc/nova/policy.json",
+            "dest": "/etc/nova/{{ nova_policy_file }}",
             "owner": "nova",
-            "perm": "0600",
+            "perm": "0600"
-            "optional": true
+        }{% endif %}
-        }
     ],
     "permissions": [
         {

ansible/roles/nova/templates/nova-consoleauth.json.j2

@@ -6,14 +6,13 @@
             "dest": "/etc/nova/nova.conf",
             "owner": "nova",
             "perm": "0600"
-        },
+        }{% if nova_policy_file is defined %},
         {
-            "source": "{{ container_config_directory }}/policy.json",
+            "source": "{{ container_config_directory }}/{{ nova_policy_file }}",
-            "dest": "/etc/nova/policy.json",
+            "dest": "/etc/nova/{{ nova_policy_file }}",
             "owner": "nova",
-            "perm": "0600",
+            "perm": "0600"
-            "optional": true
+        }{% endif %}
-        }
     ],
     "permissions": [
         {

ansible/roles/nova/templates/nova-novncproxy.json.j2

@@ -6,14 +6,13 @@
             "dest": "/etc/nova/nova.conf",
             "owner": "nova",
             "perm": "0600"
-        },
+        }{% if nova_policy_file is defined %},
         {
-            "source": "{{ container_config_directory }}/policy.json",
+            "source": "{{ container_config_directory }}/{{ nova_policy_file }}",
-            "dest": "/etc/nova/policy.json",
+            "dest": "/etc/nova/{{ nova_policy_file }}",
             "owner": "nova",
-            "perm": "0600",
+            "perm": "0600"
-            "optional": true
+        }{% endif %}
-        }
     ],
     "permissions": [
         {

ansible/roles/nova/templates/nova-scheduler.json.j2

@@ -6,14 +6,13 @@
             "dest": "/etc/nova/nova.conf",
             "owner": "nova",
             "perm": "0600"
-        },
+        }{% if nova_policy_file is defined %},
         {
-            "source": "{{ container_config_directory }}/policy.json",
+            "source": "{{ container_config_directory }}/{{ nova_policy_file }}",
-            "dest": "/etc/nova/policy.json",
+            "dest": "/etc/nova/{{ nova_policy_file }}",
             "owner": "nova",
-            "perm": "0600",
+            "perm": "0600"
-            "optional": true
+        }{% endif %}
-        }
     ],
     "permissions": [
         {

ansible/roles/nova/templates/nova-spicehtml5proxy.json.j2

@@ -6,14 +6,13 @@
             "dest": "/etc/nova/nova.conf",
             "owner": "nova",
             "perm": "0600"
-        },
+        }{% if nova_policy_file is defined %},
         {
-            "source": "{{ container_config_directory }}/policy.json",
+            "source": "{{ container_config_directory }}/{{ nova_policy_file }}",
-            "dest": "/etc/nova/policy.json",
+            "dest": "/etc/nova/{{ nova_policy_file }}",
             "owner": "nova",
-            "perm": "0600",
+            "perm": "0600"
-            "optional": true
+        }{% endif %}
-        }
     ],
     "permissions": [
         {

ansible/roles/nova/templates/nova.conf.j2

@@ -215,6 +215,11 @@ topics = {{ nova_enabled_notification_topics | map(attribute='name') | join(',')
 driver = noop
 {% endif %}
 
+{% if nova_policy_file is defined %}
+[oslo_policy]
+policy_file = {{ nova_policy_file }}
+{% endif %}
+
 [privsep_entrypoint]
 helper_command=sudo nova-rootwrap /etc/nova/rootwrap.conf privsep-helper --config-file /etc/nova/nova.conf
 

ansible/roles/nova/templates/placement-api.json.j2

@@ -8,14 +8,13 @@
             "dest": "/etc/nova/nova.conf",
             "owner": "nova",
             "perm": "0600"
-        },
+        }{% if nova_policy_file is defined %},
         {
-            "source": "{{ container_config_directory }}/policy.json",
+            "source": "{{ container_config_directory }}/{{ nova_policy_file }}",
-            "dest": "/etc/nova/policy.json",
+            "dest": "/etc/nova/{{ nova_policy_file }}",
             "owner": "nova",
-            "perm": "0600",
+            "perm": "0600"
-            "optional": true
+        }{% endif %},
-        },
         {
             "source": "{{ container_config_directory }}/placement-api-wsgi.conf",
             "dest": "/etc/{{ apache_conf_dir }}/placement-api-wsgi.conf",